AICPA SOC 3 U-2: Guard against a misleading report when a subservice organisation is carved out

Carve-out is permitted, but because a SOC 3 contains no description of the carved-out services or the controls over them, the parties consider whether it misleads readers. If the boundary disclosures do not explain how the carved-out provider affects the commitments and requirements, the report may need restricting, for example to users who also hold the subservice organisation's own SOC 2 or SOC 3 report (Guide 2.193, 4.126).